How to get your website and domain back from a web designer or agency

Look your domain up at ICANN Lookup before you email anyone. It names your registrar and expiry date; the registrant, the person or company the domain is registered to, decides the rest. If that is your business and the domain is a .com, .net, .org or other generic domain, ICANN's Transfer Policy gets you the transfer code within five calendar days of a verified request. If it is the designer or a reseller, you need their agreement. A WordPress site copies whole; Wix and HighLevel sites only change accounts.

By the Beyaoshy team16 min read

Who controls a domain: The registrant on record, the only party that can approve or deny a transfer
Transfer code deadline: 5 calendar days from the registrant's request, for .com, .net, .org and other generic domains (Transfer Policy I.A.5.2)
60-day transfer locks: A registrar may refuse within 60 days of registration or a prior transfer, and must after a change of registrant you did not opt out of
If the designer is the registrant: ICANN cannot move it; you need their agreement, a lawyer or, in trademark cases, the UDRP
Country-code domains: .us, .co, .io and other country codes follow their own registry's rules, and ICANN takes no complaints about them
Sites that cannot be exported: Wix and HighLevel sites; Squarespace exports only part of a site to an .xml file

“My website” usually means four things: the domain name, the hosting or builder account, the site’s files, and the rights in the design and code. A designer can hold any of them, and each comes back by a different route. If an agency ran more than your site, see the agency switching checklist and the free account ownership check.

What to do before you contact the designer

Start with the public record. Look the domain up at ICANN Lookup and note the registrar, expiry date, status codes and name servers (reading the lookup).
Then search your inbox and spam folder for the registrar’s name. ICANN’s Registration Data Reminder Policy makes a registrar show the registrant its current record “At least annually,” so a reminder shows whose name is on the domain. A year with no reminder in any of your inboxes suggests someone else’s email is on the record.
With a WordPress administrator login, back up the database and files today (how).
Next, email the first of the messages below so the date you asked is on record.
Until the domain sits in your account, leave the registrant name and email alone. A change can block a registrar move for 60 days (why).

Who holds your domain right now

Registrar, registrant, name servers and host are four different jobs

The registrar is the company the domain is registered through. The registrant is who it is registered to; ICANN’s Transfer Policy calls it the Registered Name Holder and makes it the only party with authority to approve or deny a transfer. The name servers hold the DNS records for your site and email, and the host stores the site; ICANN’s registrant FAQ notes you may change hosts without changing registrars.

Run the domain through ICANN Lookup

Under ICANN’s Registration Data Policy, in force since August 21, 2025, every lookup shows the registrar, creation and expiry dates and domain status, but the registrant’s name, street, phone and email may be redacted. An organization entered as Registrant Organization “will be considered the Registered Name Holder,” so a designer’s company name there makes the domain theirs on the record. The reverse also holds: your business in that field makes it yours, even with the designer’s name as the contact.

If a privacy or proxy service is listed, find out which: under the Registrar Accreditation Agreement, a privacy service only masks the real registrant’s contact details, while a proxy service is itself the registrant and licenses the domain to its customer, the reseller position described below.

Ask the registrar for the data. The Registration Data Policy makes every registrar link from its homepage to a process for requesting non-public data, acknowledge a proper request within two business days and answer within 30 calendar days. GoDaddy’s version asks you to try “Contact Domain Holder” on its WHOIS results first.
Recover the account as the registrant. If the record names your business but the login is the designer’s, go to the registrar yourself. GoDaddy’s Account Recovery has a “Domain Access” option for anyone “listed as the Registrant on one or more domains” who cannot reach the account holding them; it asks for a color copy of a government photo ID, plus business documentation when a company is listed.

Status codes to read before you ask for anything

From ICANN’s status code guide:

clientTransferProhibited is the ordinary lock, removed when the registrant asks.
serverTransferProhibited is set by the registry, “usually enacted during legal or other disputes, at your request, or when a redemptionPeriod status is in place.” Only the registry lifts it, at your registrar’s request, which ICANN says can take longer.
clientHold or serverHold means the domain has been taken out of DNS, so the site and email stop working, usually over non-payment, a dispute or a pending deletion. Contact the registrar that day; if the designer is the registrant, they have to resolve it.
redemptionPeriod means the registrar has asked for deletion: 30 days and five more calendar days later, anyone can register the domain. Call the registrar that day.

If the domain came free with your hosting

The registrant may be the host or a reseller. One business owner, whose reseller’s standard deal was, in his words, “receiving free domain name registration when purchasing a web hosting package,” complained that he got no renewal notices, but his documents “consistently listed the Reseller” as registrant. On March 8, 2026 the ICANN Board denied his request: Compliance “is unable to intervene in disputes between registrants (such as the Reseller) and third parties.” Under clause 3.7.7.3 of the Registrar Accreditation Agreement, a registrant that licenses a domain to someone else “is nonetheless the Registered Name Holder of record.”

When your business is the registrant

The Transfer Policy covers .com, .net, .org and the other generic domains: “All ICANN-accredited registrars and unsponsored gTLD registry operators are required to follow this policy,” says ICANN’s transfer page. A .us, .co or .io domain is a country code, per IANA’s root zone database, so its registry’s own rules apply, and ICANN’s complaint page says it has “no contractual authority to address complaints involving” country codes.

Five calendar days to get the transfer code

Under section I.A.5.2, a registrar that does not let you generate the transfer code (also called the AuthInfo or authorization code) yourself must send it, and remove the clientTransferProhibited lock, within five calendar days of the registrant’s first request. The clock runs once the registrar accepts you as the registrant, through the account login or its account recovery process, so without the login, start recovery first. It cannot make the code harder to get than a contact change (I.A.5.3) or hold it back solely over a payment dispute with you (I.A.5.4). A transfer fee is allowed, but a transfer “cannot be denied due to non-payment of this transfer fee.”

ICANN has adopted new rules that, per the working group’s final report, restate the five days as 120 hours, drop the 60-day lock after a registrant change, and make the locks after registration and after a registrar move a fixed 30 days. Its implementation page still lists them in the queue, and registrars get at least six months’ notice, so today’s rules apply.

When a registrar may refuse, must refuse, or cannot refuse

Section I.A.3 sorts the reasons into three lists, and a registrar that denies a transfer must say why.

May refuse, only for: fraud; a reasonable dispute over who the registrant is; an unpaid previous period, or an unpaid current period before the domain expires, after putting it on “Registrar Hold”; the registrant’s own objection; or the first 60 days after creation or a registrar transfer.
Must refuse for: a pending UDRP or URS case, a court order, a pending dispute over an earlier transfer, or the 60-day lock after a change of registrant not opted out of.
Cannot refuse for, among others: nonpayment for a pending or future period, no response from the registrant, a lock you had no reasonable chance to remove, or “General payment defaults between Registrar and business partners / affiliates in cases where the Registered Name Holder for the domain in question has paid for the registration.”

Transfer first, change the registrant second

Any change to the registrant’s email, or to the name or organization beyond a typo fix, is a Change of Registrant. After one, the registrar must lock the domain against moving registrars for 60 days, unless it offered an opt-out and you took it before the change; the FAQ says registrars need not offer one, and the policy advises moving registrars first. If the domain is in your business name but the designer’s email is on the record, move it, then update the email.

Moving the domain into your account at the same registrar

Some registrars push domains between customer accounts. On GoDaddy, the holder opens Domain Settings and, under Transfer, chooses “Transfer to another GoDaddy account”; you have 10 days to accept. It is not available once the domain has expired, is within a day of expiring, or is pending a contact update or another transfer. DNS settings come across, but “any connected products, such as a website or email, do not transfer with the domain.” Check the registrant afterward, since an account move can leave the old contact details in place, as Squarespace’s ownership change does; GoDaddy’s form asks the sender whether to copy the current contact info to the new account.

When the designer or a reseller is the registrant

Agreement, expiry, a lawyer or the UDRP

This is not legal advice; confirm with counsel.

ICANN “does not have the ability or authority to transfer or return a domain name to anyone,” says its page on lost domain names, which suggests legal advice and lists the options: an agreement with the registrant, waiting to see whether they let it expire (once a lapsed domain is purged, it goes to whoever registers it first, which may not be you), a lawsuit if you believe it was obtained unlawfully, or, in limited trademark cases, the UDRP. Its paragraph 4(a) requires a confusingly similar domain, no rights or legitimate interests, and a name “registered and is being used in bad faith.” Our reading is that a designer who registered your name at your request may not meet that last test, so agreement comes first.

Agreement still needs the designer’s confirmation: under section II.C of the Transfer Policy, a change of registrant goes through only once both the old and new registrant confirm it, within the registrar’s window of at most 60 days. Gather the contract, invoices for the domain, emails asking the designer to register it for you, and a dated screenshot of the lookup.

When a web designer holds your website hostage

When a designer stops answering, threatens to take the site down or wants money first, the registrant record sets your route.

Your business is the registrant: go around the designer to the registrar (even without a login). The code is owed to you (I.A.5.2). If the designer resells the registrar’s domains and you paid them for the registration, the registrar cannot refuse the transfer over the designer’s unpaid bills to it (I.A.3.9.5). If the domain has already expired unpaid, the registrar may refuse until it is renewed (I.A.3.7.3), so renew it first.
The designer is the registrant: the domain moves only with their agreement or by a legal route.
Either way, back up what you can reach today, such as a WordPress site; who owns the design is a separate question.
Do not charge back a renewal the registrar billed to your card. Section I.A.3.7.3 lets a registrar refuse a transfer for an unpaid period “including credit card charge-backs.”

Getting the website itself out

WordPress: the files and the database, together

The WordPress backup handbook says a full restore needs both the files (core, themes, plugins, uploads, wp-config.php, .htaccess) and the database, which “lives outside” the WordPress folder, and that backup plugins can be found in the Plugin Browser. The Tools, then Export screen is not a backup: its documentation lists posts, pages, comments, custom fields, categories, tags, taxonomies and users, while themes, plugins and uploads are files. Ask for the hosting account in your business name, or a full backup and an administrator login; for a hand-coded build, add the source code and a list of the outside services it calls.

Paid themes and page builder licenses

Theme and plugin code can usually move with your site, since WordPress.org holds that they “inherit the GPL license,” but updates run on license keys in someone’s account. For a freelancer’s single-client build, Envato’s license FAQ says “The license would in effect be transferred to the client.” An Elementor subscription transfers only whole, “with all the connected websites,” so on an agency’s multi-site plan, budget for your own. Ask which account holds each paid license and when each renews.

Wix sites change accounts, never hosts

A Wix site “needs to be hosted and operated on Wix’s servers,” Wix says. Getting it back is a premium site transfer to a Wix account in your business name: the owner clicks the Site Actions icon on the site’s dashboard, selects Transfer site and enters your account email. Ask the owner to switch on Transfer site plan and Transfer domain & business email in the transfer form, or the plan and a Wix-bought domain stay in their account. The invite “expires in 3 days,” and payment details and Wix Payments accounts do not move. The sender can keep a Co-Owner role, so check the roles once the site is yours.

Squarespace: ownership moves, the export is partial

Only the current site owner can transfer ownership, to a contributor who has accepted an invitation, under Permissions & Ownership: click the name under Owner, then Transfer Ownership. Attached subscriptions and Squarespace domains go with it. The .xml export takes one blog and leaves out store pages, product, audio and video blocks, style settings and any custom styling code. Leaving Squarespace means a rebuild.

HighLevel sites move only as a whole sub-account

HighLevel says “There is no supported 1:1 website export,” and copied page HTML depends on “the original HighLevel location and assets remaining active.” The agency has to start either route left:

To another HighLevel agency. A sub-account transfer moves the whole sub-account, and by default only the agency owner can request or complete one. Phone numbers move automatically only if both agencies use LC Phone, with eligible A2P registration staying on them; with Twilio they have to be moved separately.
To your own agency account. In an eject, a user from your sub-account signs up for a HighLevel agency plan. Websites and funnels come across, automations arrive as drafts, and Google and Facebook connections are deleted. Custom domains do not carry over, so add them again in the new account and update DNS, using the DNS export below, the day the eject is accepted.

If texting registration has to be redone, see the A2P 10DLC guide; the GoHighLevel page covers a fresh build.

Who owns the design, the code and the words

This is not legal advice; confirm with counsel.

The author starts as owner. Under 17 U.S.C. 201(a), copyright “vests initially in the author or authors of the work”: your own text and photos start as yours, the designer’s layouts and code as theirs.
A copy is not the copyright. Section 202 says transferring a material object “does not of itself convey any rights in the copyrighted work,” so having the files does not by itself make the copyright yours; whether you may keep using and changing the site is a question for counsel.
Work made for hire is narrow. Circular 30 limits it to an employee’s work within the job, or a commissioned work in one of nine categories with a signed written agreement.
Transfers must be signed. Under section 204(a), a transfer of copyright ownership needs a writing signed by the owner.

Ask for a signed assignment at handover, and write one into the next contract.

Keep email and search traffic running through the move

Email rides on the domain’s MX records, and Google Workspace warns that “Your email might not work correctly if you keep old or incorrect MX records.”

Get every DNS record before anything moves. If the lookup’s name servers belong to the designer’s host, the zone sits in their account, so the first message asks for an export; Cloudflare’s setup guide warns that even its own scan “is not guaranteed to find all existing DNS records.” Check your MX records yourself in Google’s Admin Toolbox Dig, which the Workspace guide recommends.
If DNSSEC is on, turn it off at the registrar before changing name servers. Cloudflare’s setup guide says changing them with DNSSEC active “can cause your domain to become unreachable,” and its transfer guide says to wait at least 24 hours after turning it off.
Old mail stays put at your previous email host unless you migrate it, Microsoft notes.
Protect search traffic. Google’s hosting move guide says to lower DNS TTLs at least a week ahead; if addresses change, its site move guide keeps redirects “generally at least 1 year.”

Messages to send the designer and the registrar

Send each by email so its date is on record: the registrar’s five calendar days run from your first request to it once it has verified you as the registrant (Transfer Policy I.A.5.2).

Subject: Moving our domain and website into our accounts

Hi Jordan, thanks for your work on our site. Within 10 business days, please:

Move our domain into a registrar account in our company’s name: push it to our account if the registrar allows that (we will send the details), or send the transfer code with the lock removed.

Give us administrator access to the hosting account, or a full backup of the files and database taken together.

List every paid theme, plugin and builder license on the site, and whose account holds each.

Send an export of our DNS records, including the MX records for email.

Please leave DNS and email settings unchanged while we move. Thanks, Dana

The designer is the registrant

Our domain is registered in your name, and we need it registered to our company. Please either push it into our account at the same registrar, or send us the transfer code and remove the transfer lock so we can move it into our own registrar account. If the registrar then emails you to confirm the change of registrant to our company, please approve it; we will confirm on our side.

Add the website, license and DNS items from the first message.

To the registrar, when your business is the registrant

Without the login, start the registrar’s account recovery first, then send this.

Our company is the registrant of the domain on this account. We are completing your identity verification through your account recovery process. Please send the transfer authorization code and remove the clientTransferProhibited status, which section I.A.5.2 of ICANN’s Transfer Policy requires within five calendar days of this request. If you later deny the transfer itself, section I.A.3.7 requires you to give the reason.

If the registrar refuses without a permitted reason, ICANN’s FAQ says to file a Transfer Complaint with ICANN.

Put the rebuild in your own name

Domain: a registrar account your business owns, the business as registrant, an email you control, auto-renew on your card, and the designer on delegate access, which GoDaddy offers, rather than your login.
Site: the hosting or builder account in your name, the designer in a removable role such as Squarespace contributor.
Contract: licenses in your name, and a signed clause assigning the site’s copyright to you on payment.
Links: if a rebuild changes addresses, update the website link on your Business Profile and the landing pages in Google Ads. If the designer also holds those accounts, see the Business Profile and Google Ads recovery guides.

On sites Beyaoshy builds, the domain and the website are set up in the client’s name from the start, so a client who leaves has nothing to recover; the websites page shows what a rebuild involves.

Questions about getting a website and domain back

My web designer registered my domain in their own name. Can they keep it?

ICANN treats them as the registrant even though you use the domain, and will not move it for you. Your routes are an agreement, a lawyer or, in narrow trademark cases, the UDRP. This is not legal advice; confirm with counsel.

My web designer disappeared. How do I get my domain back?

Find the registrar’s yearly data reminder and look the domain up. If your business is the registrant, the registrar can verify you without the designer, as GoDaddy’s Account Recovery does. If not, only the designer’s agreement or a legal route moves it. If it lapses, it goes to whoever registers it first once it is purged, which may not be you.

How long does my registrar have to give me the transfer code?

Five calendar days from your first request, for a generic domain registered to your business, once the registrar has verified you as the registrant; the five-day section covers the exceptions and the rules still to come.

Why does my registrar say I cannot transfer my domain for 60 days?

Usually because the domain is new, moved registrars recently, or had its registrant name or email changed; the three lists show which of those locks are optional.

Will my business email stop working when the domain moves?

Not if the MX records come across intact. Get the full DNS export first, and see the email and search checklist for DNSSEC and old mail.

Sources

45 cited

Every figure and rule above links to its source where it appears. Rules change, so confirm anything legal with counsel.

Get your site and domain back in your name.

Tell us what the designer still holds and we will send back the order to recover it in, and what a rebuild would involve if you need one.

A free consult. A real conversation about your business, your area and what is not working yet.
An honest evaluation. Where you stand in search, ads and follow-up next to the businesses you lose customers to.
A plan you keep. What we would fix first and why. It is yours whether or not you work with us.

Form not loading? Email hello@beyaoshy.com and we will reply within one business day.